Security

Can you help me with to identify a hyperlink from a database?

ashok968
Loves-to-Learn

Hi,

I am getting around 1000 charters of text message from database for each record contains hyperlink present in some where.

  1. How to identify that hyperlink ?
  2. How to highlight that hyperlink ?

thanks in advance

Tags (1)
0 Karma

ashok968
Loves-to-Learn

Hi ,

Thanks for responding i have tried above but i was not able to get the result.

My search result is resulting the below text in one filed.Now i want to high late the http link and if i click on that respective page should open.

*Net banking is not working properly https:\xxyz.com*

Thanks in advance,Hi ,

Thanks for responding i have tried above but i was not able to get the result.

My search result is resulting the below text in one filed.Now i want to high late the http link and if i click on that respective page should open.

*Net banking is not working properly https:\xxyz.com*

Thanks in advance

0 Karma

MousumiChowdhur
Contributor

Hi @ashok968 ,

You can try the below regular expression to identify and extract your hyperlink from the events.

index=<your index> | rex "(?P<hyperlink>(https|http).*\/\w+[^\s]+)" max_match=0

Well, to highlight you can use the below command at the end of the above search string shown as below:

index=<your index> | rex "(?P<hyperlink>(https|http).*\/\w+[^\s]+)" max_match=0 | highlight "http","https"

Though the highlight command doesn't support regular expressions or wildcards or anything, so that will be difficult to highlight the complete hyperlink. If the number of possible hyperlinks is limited, you could create a macro that contains a highlight command with all possible message strings behind it.

Thank You!

0 Karma

ashok968
Loves-to-Learn

Hi ,

Thanks for responding i have tried above but i was not able to get the result.

My search result is resulting the below text in one filed.Now i want to high late the http link and if i click on that respective page should open.

*Net banking is not working properly https:\xxyz.com*

Thanks in advance

0 Karma
Get Updates on the Splunk Community!

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...

[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...

Overwhelmed SOC? Splunk ES Has Your Back Tool sprawl, alert fatigue, and endless context switching are making ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...